Clínica Digital Software SOFTWARE
Demo
← Back to news
News 11 October 2026 · 7 min read

OMC publishes ten-point guide on informed consent

OMC issues a ten-point guide on informed consent and required documents clinics must review under Law 41/2002 and AEPD (Spain's data protection authority)

The Organización Médica Colegial (OMC) has published a Decalogue on Informed Consent as a practical reference for professionals, bringing together criteria aligned with Ley 41/2002 on patient autonomy and with obligations on information and clinical documentation. The text, published by the OMC, appears against a backdrop of increased regulatory focus on filing, custody and access to clinical documentation, with regional inspection plans that expressly include verification of these aspects, according to resolutions published by regional health administrations.

For a clinic or private practice in Spain, the immediate implication is operational: review forms, signature workflows, custody and traceability of informed consent where required, and separate that care-related consent from consent (where applicable) for other data uses, following the criteria of the AEPD (Spain’s data protection authority).

What the OMC has published and who in a private practice finds it useful

The OMC, through its Central Commission of Deontology, has produced a practical decalog on informed consent, according to the organisation. The document serves as a checklist of minimums: informed consent is not just a printed form, but a process of information that should be reflected in the clinical record where the regulations require it.

From a management perspective, the decalog helps to standardise practices among professionals (both employees and collaborators), reinforce internal criteria and prepare documentary audits. Ley 41/2002 sets the basic state framework on patient autonomy and clinical information, according to the consolidated text published in the BOE (Spain’s official gazette), and serves as a common reference even where there are regional developments.

Basic framework: what Ley 41/2002 requires on information and documentation

Ley 41/2002, of 14 November, published in the BOE, regulates patient autonomy and establishes the foundations on clinical information and clinical documentation. For centre management, the key point is that informed consent is part of the clinical documentation the centre must organise, preserve and produce when appropriate, in coordination with the clinical record.

The state law is especially relevant for private clinics because it sets the common floor: what is considered a healthcare centre and the role of clinical documentation as the record of the care provided, according to the BOE. From there, each clinic must translate it into internal procedures: who informs the patient, who obtains the signature where applicable, how it is filed, who is responsible for custody and how access is managed.

The AEPD (Spain’s data protection authority), in its Guide for professionals in the healthcare sector, distinguishes two levels that are often confused in daily operations:

  • Informed consent for healthcare interventions that require it (clinical consent), which the AEPD says “must be informed and in writing” where applicable.
  • The processing of personal data for healthcare purposes, for which, according to the AEPD, it is not necessary to obtain the patient’s consent, although it is mandatory to provide information about the processing of their data in accordance with data protection rules.

For the clinic, this distinction means reviewing wording and checkboxes on forms: combining consent for a clinical act with generic authorisations for data processing in the same document can create friction in inspections or complaints. The AEPD emphasises that healthcare has its own legal fit for data processing, while consent should be reserved for cases where it is the appropriate legal basis and meets the required conditions.

What to check in forms and the documentary circuit

From a management point of view, centres should ensure that their workflow leaves documentary evidence consistent with publicly available criteria:

Minimum content and signature traceability

Public templates such as Annex VIII-A of the AEMPS (used in clinical research) show a structure considered good documentary practice: a statement that the person “will receive a signed and dated copy” and spaces for signatures and dates, according to the AEMPS document itself. Without automatically applying that template to routine care, it gives an idea of the standard: date, signatures, copy and custody.

In private practice, the practical review involves checking that:

  • the document includes identification and a date;
  • the patient receives a copy where appropriate (if this is established in the document and internal circuit);
  • the filing system allows retrieval of the evidence without depending on a specific professional.

The European Commission reminds, in its public material on consent, that consent must be free, specific, informed and unambiguous, given by a clear affirmative action, and that it must be withdrawable as easily as it was given, according to the European Commission. Although this framework is applied in many contexts, in healthcare management it highlights a common risk: using catch‑all consents for purposes that are not strictly clinical.

The practical consequence is organisational: if the clinic requests consents for different purposes (for example, non-clinical communications), these should be clearly separated and have manageable withdrawal mechanisms, in line with the general consent criteria cited by the European Commission.

Following court decisions and legal commentary helps to understand how the solidity of documented consent is assessed. The newspaper elEconomista reported a European Court of Human Rights decision upholding that informed consent for surgery “cannot be revoked during the operation”, according to its report. Without entering clinical indications, the operational takeaway for a clinic is that documented consent is assessed in a temporal and procedural context: when it was signed, what information is recorded and how it is evidenced.

From a documentary compliance perspective, this reinforces the need for the centre to have a homogeneous and verifiable process, not one based on informal practices.

Inspection and regional developments: focus on filing, custody and access

Pressure comes not only from complaints but also from inspection planning and regional regulatory developments that have been published.

  • In Canarias, a resolution of 17/02/2026 includes among its objectives verifying the correct completion, filing and custody of clinical documentation, as well as access to it, according to the text published in the regional legislative repository.
  • In the Comunitat Valenciana, a resolution of 5 August 2026 establishes a structure related to health data and explicitly cites the framework of the GDPR (EU) 2016/679 for the protection of health data, according to the published resolution.
  • In Andalucía, a resolution of 22 September 2026 explicitly lists as subjects “information and clinical documentation: informed consent; the clinical record; the discharge report and other clinical documentation”, according to the published text.
  • In Asturias, Decree 55/2026, of 10 August, regulates the accreditation of centres and assigns authorisations and accreditations to the competent department for health, according to the published decree.

For a private practice operating in one or several regions, these references require management to map regional obligations (if any) on formats, custody and access, and to coordinate them with the state framework of Ley 41/2002 and the data protection requirements highlighted by the AEPD.

Management actions prompted by this publication

Based on the OMC decalog and the public framework cited from the BOE and the AEPD, the checklist for management/administration can be summarised in three strands:

Internal audit of clinical documentation

Check that informed consent (where applicable) is embedded in a procedure: issuance, signature, delivery of a copy if relevant, filing and retrieval. Sanitary inspection may focus on “filing and custody”, as indicated in the inspection planning cited for Canarias.

Health data governance

Align privacy notices and access circuits with the AEPD guidance for the healthcare sector, distinguishing mandatory data protection information from clinical consent, in line with the AEPD guide.

Coordination with external counsel

Where there are doubts due to regional differences or contractual situations (collaborating professionals, accredited centres, etc.), the interpretation and translation into procedures should be validated with legal counsel, since regional developments and their inspection plans are published via resolutions and decrees, as cited in the regional texts.

This article summarises public information from the sector. It is not legal or tax advice.

Tags informed consent clinical documentation Law 41/2002 the AEPD (Spain's data protection authority) clinical record data protection private clinics health inspection